diff options
| author | MichaIng <micha@dietpi.com> | 2023-02-13 14:09:13 +0100 |
|---|---|---|
| committer | MichaIng <micha@dietpi.com> | 2023-02-15 20:16:51 +0100 |
| commit | 5f90b8eb118324627d5845e2a7a6fa8613bf4579 (patch) | |
| tree | 612cf8b502fcfc5c607ce6c7fc8aa22baa0f32c8 /core/js/setupchecks.js | |
| parent | b36a31c918ad997e6d227dc7923791c487e18e51 (diff) | |
| download | nextcloud-server-5f90b8eb118324627d5845e2a7a6fa8613bf4579.tar.gz nextcloud-server-5f90b8eb118324627d5845e2a7a6fa8613bf4579.zip | |
Change X-Robots-Tag header from "none" to "noindex, nofollow"
While "none" is indeed equivalent to "noindex, nofollow" for Google, but seems to be not supported by Bing and probably other search engines.
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name#other_metadata_names
https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag?hl=de#comma-separated-list
https://www.bing.com/webmasters/help/which-robots-metatags-does-bing-support-5198d240
Signed-off-by: MichaIng <micha@dietpi.com>
Diffstat (limited to 'core/js/setupchecks.js')
| -rw-r--r-- | core/js/setupchecks.js | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/core/js/setupchecks.js b/core/js/setupchecks.js index 73896f9fc91..b2d021c6265 100644 --- a/core/js/setupchecks.js +++ b/core/js/setupchecks.js @@ -628,13 +628,13 @@ if (xhr.status === 200) { var securityHeaders = { 'X-Content-Type-Options': ['nosniff'], - 'X-Robots-Tag': ['none'], + 'X-Robots-Tag': ['noindex, nofollow'], 'X-Frame-Options': ['SAMEORIGIN', 'DENY'], 'X-Permitted-Cross-Domain-Policies': ['none'], }; for (var header in securityHeaders) { var option = securityHeaders[header][0]; - if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).toLowerCase() !== option.toLowerCase()) { + if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).replace(/, /, ',').toLowerCase() !== option.replace(/, /, ',').toLowerCase()) { var msg = t('core', 'The "{header}" HTTP header is not set to "{expected}". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.', {header: header, expected: option}); if(xhr.getResponseHeader(header) && securityHeaders[header].length > 1 && xhr.getResponseHeader(header).toLowerCase() === securityHeaders[header][1].toLowerCase()) { msg = t('core', 'The "{header}" HTTP header is not set to "{expected}". Some features might not work correctly, as it is recommended to adjust this setting accordingly.', {header: header, expected: option}); |